12 ms·

This opinion is based on a fundamental misunderstanding of how the internet works. A client which is on the same network as a server can request data from the

This opinion is based on a fundamental misunderstanding of how the internet works. A client which is on the same network as a server can request data from the server, and the server chooses how to reply. The internet is just a really big network, so for an internet-facing computer the assumption is that anyone can request data. The analogy of the request-response process to physical space isn't--as the judge claimed--someone entering a building, but rather someone asking permission to enter the building. Asking permission to enter a bank with a shotgun is very different from actually entering and is not itself a crime (as far as I'm aware). Every interaction between the client and server begins as a request from the client. If the server replies "yes, have some data" it's nonsensical that this could be construed as gaining unauthorized access, as Facebook claims. Ultimately, Facebook still controls access to its servers; it just hasn't figured out a good policy for denying certain requests. This is a technical problem which should be solved through technical means (e.g. blocking IP addresses) or by changing its terms of service with its users. Unfortunately, rather than solving the problem itself, Facebook has convinced the federal government to work on its behalf through an especially blunt weapon known as the CFAA. This risks changing the entire legal framework in which everyone else is required to operate. Technology moves much faster than the laws governing it, so we may not appreciate the full impact of this decision until later. That should give even proponents some pause.

reddytowns 10y ago
Every interaction between the client and server begins as a request from the client. If the server replies "yes, have some data" it's nonsensical that this could be construed as gaining unauthorized access, as Facebook claims. Using the same line of reasoning, you could explain away every computer breach in history as being authorized by the entity that suffered the breach...
- a_imho 10y ago
  Well, taking aside that security is hard, everyone should be responsible for their system and it is a much more apt analogy. The only thing that gives a free pass imo is that it is impossible to be 100% secure.
- Canada 10y ago
  That's true, you could, however in this case Power isn't exploiting a security vulnerability in Facebook. Power is acting on behalf of a user. This is like saying a maid is guilty of trespassing because a tenant provided his room key while the landlord has a strict "no roommates" policy.
  - DougBTX 10y ago
    I like this analogy, it extends quite well. Two more cases to consider: the landlord has a "no sharing keys" policy, and it has told the maid, "you may not enter, regardless of which keys you have".
    - acranox 10y ago
      But the maids agreement is with the tenant, not the landlord. So if the landlord wants to ban the maid, maybe they should change the locks, or kick out the tenant. The key sharing policy would be between the tenant and the landlord, not directly with the maid.
  - rayiner 10y ago
    That analogy is bad because the tenant has the right to possess his apartment, and has the legal power to consent to people being there. Indeed, it would probably be illegal for the landlord to keep the tenant from letting a maid in. Facebook users have no property interest in Facebook accounts. They can't consent for someone to access the accounts over Facebook's objection.
    - erroneousfunk 10y ago
      Second this. A lot of the comments in this thread reveal some fundamental -- not "misunderstandings" because I'm pretty confident that we all know how the Internet works -- but perhaps "incorrect patterns of thinking/mental shorthands" about the Internet. There are certain concepts that we often seem to forget when we're using the Internet day in and day out. Things like: "Facebook provides a service," "they're a private company," "you do not have an inalienable right to the service," "the service costs them money to provide," "content creators have certain IP rights to the content they create, but this does not translate into a fundamental right to use the Facebook service," "servers are real physical things," etc. I can't believe how many people are going along with the whole "comparing Facebook to your rented apartment" line of thinking...
- erroneousfunk 10y ago
  This is like being banned from a restaurant, then returning the next day and saying "well, I pushed on the door and it opened, so it's nonsensical to say I was trespassing"
JimDabell 10y ago
Isn't that a bit like arguing that if you're banned from a shopping centre, then if you walk past a security guard that doesn't recognise you, they should't be able to prosecute you for trespassing? After all the security guard let you past. What if he was polite and opened the door for you? Security measures are imperfect and always will be. I don't think you can argue that those imperfections grant somebody authorisation when it has already been made clear to them that they aren't authorised. If somebody has been banned from accessing a service, I don't think 200 OK can reasonably be construed as lifting that ban.
- radiorental 10y ago
  I think your analogy is incorrect. On a network you have to first identify yourself and then request access. If you have been specifically asked to not access that (open) network in the past the onus should be on the network to keep a record of you. If you knowingly change your identity to bypass that level of security, then yes you are now trespassing.
  - nxc18 10y ago
    Power deliberately changed their IP address after being blocked by Facebook, so yes, they deliberately changed their identity and were in fact trespassing.
    - radiorental 10y ago
      case closed, no new precedent needs to be set.
    - acranox 10y ago
      IP address does not equal identity.
      - coldtea 10y ago
        For the purposes of this discussion, and the "technical solutions" the grantparent asks for, it does.
johncolanduoni 10y ago
How does anything you said fail to apply to using a software vulnerability to create a request to which the server responds with "yes sir, here is the private information you requested"? Should we just say it's a technical problem that the operator should have solved themselves and make that legal too? How about physical locks while we're at it? I'm not a fan of this ruling but your argument proves too much.
biot 10y ago
Normally I'd agree with you... see https://news.ycombinator.com/item?id=6434400#6435092 https://news.ycombinator.com/item?id=6434400#6435092 However in this case when you receive a cease and desist letter informing you that you don't have permission yet you explicitly ignore it and take steps to circumvent any technical restrictions that were put in place, that's where it crosses the line.
- simonh 10y ago
  Yes the judge ruled that even though knowingly accessing a service in violation of it's TOS is not a crime, accessing it after being sent a cease and desist is. So it appears that the way in which you are asked not to do something has a bearing on whether it's ok for you to do it or not. That seems pretty crazy. Facebook as a way to prevent this access that's guaranteed to work. They could block the user's account. Furthermore the Judge's argument regarding a bank barring someone from entering if they are carrying a shotgun is bogus. They could just as well use an example of banning someone if they are carrying a cuddly toy. Using a gun in the example is a transparent attempt to appeal to emotion. There's nothing in Power Ventures activities that could be reasonably equated to openly toting a deadly weapon in a bank.
  - franciscop 10y ago
    What if I know I'm doing something that Facebook doesn't like, see an email from them and ignore/delete it? Where does a "Please stop using our web" become a Cease and Desist order?
  - deleted 10y ago
    [deleted]
  - coldtea 10y ago
    >So it appears that the way in which you are asked not to do something has a bearing on whether it's ok for you to do it or not. That seems pretty crazy. How's that even remotely "crazy"? If I merely ask you "I don't want to see you here again", and you come back, you don't get much problems with the law. If I get a restricting order on you, and you came back, I can have you arrested. There are different levels of being "told not to do something", and some popup has less power than a TOS, which has less power than a cease and desist, which has less power than a full court order, etc...
warfangle 10y ago
Facebook did block their IP address.
rayiner 10y ago
Power had a clear signal that it's license to access Facebook's website had been revoked-- the C&D. In order to get around that, you're anthropomorphizing the computer and asserting that the computer can consent to access contrary to Facebook's express intent. That makes no sense. The computer is a machine-- it cannot grant consent. Now, in some cases, you may reasonably infer that the property owner consented based on the computer allowing the access. "I thought I had permission because I was able to get the data from the computer" should be a defense. But that rationale disappears when the property owner makes its intent clear by other means.
- madmax96 10y ago
  Exactly this. If you're on example.com/documents/foo and think there might be something relevant on example.com/documents/, try and gain access without coming across a warning or terms of service reasonably located, this is clearly acceptable. Now if example.com warns you that they consider this unauthorized action and blocks your ip... well, that changes things.
- riskable 10y ago
  > Power had a clear signal that it's license to access Facebook's website had been revoked Wait: When did accessing Facebook require a license? Shouldn't the fact that Facebook is publicly-accessible make that argument moot? I don't think there's a good analogy to be made here. Facebook lets anyone use their service for free, publicly advertises it as such, and exposes loads of APIs to the world in order to facilitate that. What we have here is a company using those APIs in a way Facebook doesn't like. So what? It's not like Power's access of Facebook results in any sort of excessive burden on Facebook's servers. It just isn't compatible with their business model. Governments should never be in the business of protecting business models.
  - rayiner 10y ago
    > Wait: When did accessing Facebook require a license? Shouldn't the fact that Facebook is publicly-accessible make that argument moot? Accessing other peoples' private property requires a license. That's true even when the property owner offers use of the property to the public. In that case, the license is implicitly granted, but can be explicitly revoked. E.g. shoppers have an implied license to walk into a mall, but malls are still private property and the owner can revoke that license at will. > Governments should never be in the business of protecting business models. In this case, the government is just protecting the property owner's right to exclude other people from its property. You can build a business on that right--e.g. Disney Land builds a whole business on excluding people from its theme parks unless they pay--but the protection exists even when no business model takes advantage of it. E.g. I can allow everyone in the world to use my pool for free, except Bob. No business model to protect--I just hate Bob and want to spite him. In fact, Bob isn't even doing anything bad on my property--I just hate his haircut. The government still has to enforce my right to exclude.
tptacek 10y ago
Someone raises this argument in every thread about the concept of unauthorized access. I have yet to obtain from those threads a satisfactory answer to this question: If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injection vulnerability on the Internet is also an "authorized" form of access to people's backend databases. Nobody should be prosecuted for those either. After all, most of those attacks take the form of simple HTTP requests --- in fact, many of them are triggerable simply from GET URLs. How does this definition of "authorization" make sense?
- jasonkostempski 10y ago
  Classifying data of any form as illegal is a dangerous idea. Requests with SQL in them shouldn't be illegal. If people want laws against hacking, they should be based on something other than the contents of files and electricity on wires. If they can't find something, there just shouldn't be a law.
  - rayiner 10y ago
    But it seems to me like 'ramblenode is arguing the exact opposite: that the law ignores the HTTP request and response on the wire to look at the actual interaction between Power and Facebook and the result of the packets Power sent.
    - themihai 10y ago
      The SQL injection is more like entering using a `back door` instead asking for permission. Power used the facebook API which is the `main entrance`.
      - deleted 10y ago
        [deleted]
      - dpark 10y ago
        You realize trespassing is illegal regardless of which door you use, right?
madmax96 10y ago
I disagree. If there's a bug in the server and someone exploits it to gain unauthorized access -- even if the user has been warned via terms of service that doing this is unauthorized -- then by your interpretation this shouldn't be considered unauthorized access. Power was explicitly warned their behavior was unauthorized, had their IP banned, and Power implicitly acknowledged this ban by changing their IP. >Ultimately, Facebook still controls access to its servers; it just hasn't figured out a good policy for denying certain requests. Not having a lock on your door does not give everyone permission to walk into your home.
- logfromblammo 10y ago
  That's actually something that varies by state. Some states are more permissive than others when it comes to being in places where you don't have an affirmative legal right to be present, as might be indicated by a lease or ownership document. At one extreme, you have Scandinavian-style allmansratten, wherein the right to wander is firmly entrenched in the culture, and trespassing requires an obvious, posted, and defended boundary. If your door has no lock, that is an implicit invitation for any wanderers to enter, also under the implicit condition that they comport themselves appropriately as your guests, even if you are not actually there. At the other extreme, you have military bases, where you must show identification and your invitation at fixed points of entry, and you might get shot without warning if you are in an area that you have not been specifically authorized to be in. So there are actually states in the U.S. where you can enter an unlocked home during daylight hours, sit on the couch and read a magazine, make awkward small talk, then leave before sundown, and no crime has occurred. And then there are other states where the homeowner or leaseholder could shoot you as you did that, without saying a word, and not commit a crime. But I know of no jurisdiction where a trespass warning, where the visitor is specifically told to leave and not return, does not trump all of that. If you have been ejected from someone's property, and return to it at a later date, you are trespassing, period. It does not matter if you have disguised yourself such that you are not recognizable to anyone else as the same person; you still are that person, and that person is not allowed to be there.
  - shabble 10y ago
WildUtah 10y ago
"This opinion is based on a fundamental misunderstanding of how the internet works." Your opinion is based on a fundamental misunderstanding of how the law works. Under the CFAA, to "intentionally accesses a computer without authorization" is a federal crime under most circumstances. If you don't have a written authorization from Facebook before you send your first HTTP request, you're already a criminal. Of course, the prosecutors interpret that to mean, at various times, exactly whatever they feel it should mean. You can't tell in advance what that will be. But the judges and the jurors will pretty much follow whatever they say because they don't understand what happened. In that case, it's natural for them to just go along with whatever the FBI's paid 'experts' tell them. That's how we keep law and order in a free country.
- balabaster 10y ago
  He didn't access a computer, he requested information from the computer, over a public channel, which was given. This is a semantic difference so it doesn't matter that the CFAA that they consider the crime "intentionally accessing a computer without authorization" - he didn't remote desktop to the machine and log in and access the file system and get information. He used the OAuth protocol which is afforded over public channels exactly as prescribed to say "This user has granted me access to this information, please give it to me" and Facebook has said "here you go"... This is akin to asking for the information, being issued a cease and desist to prevent you from asking for it again and then using the Freedom of Information Act to request information and subsequently being arrested for being in possession of that information on the grounds that you illegally obtained that information by breaking and entering and accessing files you weren't authorized to access... which you can see is clearly not true.

reddytowns 10y ago

Every interaction between the client and server begins as a request from the client. If the server replies "yes, have some data" it's nonsensical that this could be construed as gaining unauthorized access, as Facebook claims. Using the same line of reasoning, you could explain away every computer breach in history as being authorized by the entity that suffered the breach...

a_imho 10y ago
Well, taking aside that security is hard, everyone should be responsible for their system and it is a much more apt analogy. The only thing that gives a free pass imo is that it is impossible to be 100% secure.
Canada 10y ago
That's true, you could, however in this case Power isn't exploiting a security vulnerability in Facebook. Power is acting on behalf of a user. This is like saying a maid is guilty of trespassing because a tenant provided his room key while the landlord has a strict "no roommates" policy.
- DougBTX 10y ago
  I like this analogy, it extends quite well. Two more cases to consider: the landlord has a "no sharing keys" policy, and it has told the maid, "you may not enter, regardless of which keys you have".
  - acranox 10y ago
    But the maids agreement is with the tenant, not the landlord. So if the landlord wants to ban the maid, maybe they should change the locks, or kick out the tenant. The key sharing policy would be between the tenant and the landlord, not directly with the maid.
- rayiner 10y ago
  That analogy is bad because the tenant has the right to possess his apartment, and has the legal power to consent to people being there. Indeed, it would probably be illegal for the landlord to keep the tenant from letting a maid in. Facebook users have no property interest in Facebook accounts. They can't consent for someone to access the accounts over Facebook's objection.
  - erroneousfunk 10y ago
    Second this. A lot of the comments in this thread reveal some fundamental -- not "misunderstandings" because I'm pretty confident that we all know how the Internet works -- but perhaps "incorrect patterns of thinking/mental shorthands" about the Internet. There are certain concepts that we often seem to forget when we're using the Internet day in and day out. Things like: "Facebook provides a service," "they're a private company," "you do not have an inalienable right to the service," "the service costs them money to provide," "content creators have certain IP rights to the content they create, but this does not translate into a fundamental right to use the Facebook service," "servers are real physical things," etc. I can't believe how many people are going along with the whole "comparing Facebook to your rented apartment" line of thinking...
erroneousfunk 10y ago
This is like being banned from a restaurant, then returning the next day and saying "well, I pushed on the door and it opened, so it's nonsensical to say I was trespassing"

JimDabell 10y ago

Isn't that a bit like arguing that if you're banned from a shopping centre, then if you walk past a security guard that doesn't recognise you, they should't be able to prosecute you for trespassing? After all the security guard let you past. What if he was polite and opened the door for you? Security measures are imperfect and always will be. I don't think you can argue that those imperfections grant somebody authorisation when it has already been made clear to them that they aren't authorised. If somebody has been banned from accessing a service, I don't think 200 OK can reasonably be construed as lifting that ban.

radiorental 10y ago
I think your analogy is incorrect. On a network you have to first identify yourself and then request access. If you have been specifically asked to not access that (open) network in the past the onus should be on the network to keep a record of you. If you knowingly change your identity to bypass that level of security, then yes you are now trespassing.
- nxc18 10y ago
  Power deliberately changed their IP address after being blocked by Facebook, so yes, they deliberately changed their identity and were in fact trespassing.
  - radiorental 10y ago
    case closed, no new precedent needs to be set.
  - acranox 10y ago
    IP address does not equal identity.
    - coldtea 10y ago
      For the purposes of this discussion, and the "technical solutions" the grantparent asks for, it does.

johncolanduoni 10y ago

How does anything you said fail to apply to using a software vulnerability to create a request to which the server responds with "yes sir, here is the private information you requested"? Should we just say it's a technical problem that the operator should have solved themselves and make that legal too? How about physical locks while we're at it? I'm not a fan of this ruling but your argument proves too much.

biot 10y ago

Normally I'd agree with you... see https://news.ycombinator.com/item?id=6434400#6435092 https://news.ycombinator.com/item?id=6434400#6435092 However in this case when you receive a cease and desist letter informing you that you don't have permission yet you explicitly ignore it and take steps to circumvent any technical restrictions that were put in place, that's where it crosses the line.

simonh 10y ago
Yes the judge ruled that even though knowingly accessing a service in violation of it's TOS is not a crime, accessing it after being sent a cease and desist is. So it appears that the way in which you are asked not to do something has a bearing on whether it's ok for you to do it or not. That seems pretty crazy. Facebook as a way to prevent this access that's guaranteed to work. They could block the user's account. Furthermore the Judge's argument regarding a bank barring someone from entering if they are carrying a shotgun is bogus. They could just as well use an example of banning someone if they are carrying a cuddly toy. Using a gun in the example is a transparent attempt to appeal to emotion. There's nothing in Power Ventures activities that could be reasonably equated to openly toting a deadly weapon in a bank.
- franciscop 10y ago
  What if I know I'm doing something that Facebook doesn't like, see an email from them and ignore/delete it? Where does a "Please stop using our web" become a Cease and Desist order?
- deleted 10y ago
  [deleted]
- coldtea 10y ago
  >So it appears that the way in which you are asked not to do something has a bearing on whether it's ok for you to do it or not. That seems pretty crazy. How's that even remotely "crazy"? If I merely ask you "I don't want to see you here again", and you come back, you don't get much problems with the law. If I get a restricting order on you, and you came back, I can have you arrested. There are different levels of being "told not to do something", and some popup has less power than a TOS, which has less power than a cease and desist, which has less power than a full court order, etc...

warfangle 10y ago

Facebook did block their IP address.

rayiner 10y ago

Power had a clear signal that it's license to access Facebook's website had been revoked-- the C&D. In order to get around that, you're anthropomorphizing the computer and asserting that the computer can consent to access contrary to Facebook's express intent. That makes no sense. The computer is a machine-- it cannot grant consent. Now, in some cases, you may reasonably infer that the property owner consented based on the computer allowing the access. "I thought I had permission because I was able to get the data from the computer" should be a defense. But that rationale disappears when the property owner makes its intent clear by other means.

madmax96 10y ago
Exactly this. If you're on example.com/documents/foo and think there might be something relevant on example.com/documents/, try and gain access without coming across a warning or terms of service reasonably located, this is clearly acceptable. Now if example.com warns you that they consider this unauthorized action and blocks your ip... well, that changes things.
riskable 10y ago
> Power had a clear signal that it's license to access Facebook's website had been revoked Wait: When did accessing Facebook require a license? Shouldn't the fact that Facebook is publicly-accessible make that argument moot? I don't think there's a good analogy to be made here. Facebook lets anyone use their service for free, publicly advertises it as such, and exposes loads of APIs to the world in order to facilitate that. What we have here is a company using those APIs in a way Facebook doesn't like. So what? It's not like Power's access of Facebook results in any sort of excessive burden on Facebook's servers. It just isn't compatible with their business model. Governments should never be in the business of protecting business models.
- rayiner 10y ago
  > Wait: When did accessing Facebook require a license? Shouldn't the fact that Facebook is publicly-accessible make that argument moot? Accessing other peoples' private property requires a license. That's true even when the property owner offers use of the property to the public. In that case, the license is implicitly granted, but can be explicitly revoked. E.g. shoppers have an implied license to walk into a mall, but malls are still private property and the owner can revoke that license at will. > Governments should never be in the business of protecting business models. In this case, the government is just protecting the property owner's right to exclude other people from its property. You can build a business on that right--e.g. Disney Land builds a whole business on excluding people from its theme parks unless they pay--but the protection exists even when no business model takes advantage of it. E.g. I can allow everyone in the world to use my pool for free, except Bob. No business model to protect--I just hate Bob and want to spite him. In fact, Bob isn't even doing anything bad on my property--I just hate his haircut. The government still has to enforce my right to exclude.

tptacek 10y ago

Someone raises this argument in every thread about the concept of unauthorized access. I have yet to obtain from those threads a satisfactory answer to this question: If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injection vulnerability on the Internet is also an "authorized" form of access to people's backend databases. Nobody should be prosecuted for those either. After all, most of those attacks take the form of simple HTTP requests --- in fact, many of them are triggerable simply from GET URLs. How does this definition of "authorization" make sense?

jasonkostempski 10y ago
Classifying data of any form as illegal is a dangerous idea. Requests with SQL in them shouldn't be illegal. If people want laws against hacking, they should be based on something other than the contents of files and electricity on wires. If they can't find something, there just shouldn't be a law.
- rayiner 10y ago
  But it seems to me like 'ramblenode is arguing the exact opposite: that the law ignores the HTTP request and response on the wire to look at the actual interaction between Power and Facebook and the result of the packets Power sent.
  - themihai 10y ago
    The SQL injection is more like entering using a `back door` instead asking for permission. Power used the facebook API which is the `main entrance`.
    - deleted 10y ago
      [deleted]
    - dpark 10y ago
      You realize trespassing is illegal regardless of which door you use, right?

madmax96 10y ago

I disagree. If there's a bug in the server and someone exploits it to gain unauthorized access -- even if the user has been warned via terms of service that doing this is unauthorized -- then by your interpretation this shouldn't be considered unauthorized access. Power was explicitly warned their behavior was unauthorized, had their IP banned, and Power implicitly acknowledged this ban by changing their IP. >Ultimately, Facebook still controls access to its servers; it just hasn't figured out a good policy for denying certain requests. Not having a lock on your door does not give everyone permission to walk into your home.

logfromblammo 10y ago
That's actually something that varies by state. Some states are more permissive than others when it comes to being in places where you don't have an affirmative legal right to be present, as might be indicated by a lease or ownership document. At one extreme, you have Scandinavian-style allmansratten, wherein the right to wander is firmly entrenched in the culture, and trespassing requires an obvious, posted, and defended boundary. If your door has no lock, that is an implicit invitation for any wanderers to enter, also under the implicit condition that they comport themselves appropriately as your guests, even if you are not actually there. At the other extreme, you have military bases, where you must show identification and your invitation at fixed points of entry, and you might get shot without warning if you are in an area that you have not been specifically authorized to be in. So there are actually states in the U.S. where you can enter an unlocked home during daylight hours, sit on the couch and read a magazine, make awkward small talk, then leave before sundown, and no crime has occurred. And then there are other states where the homeowner or leaseholder could shoot you as you did that, without saying a word, and not commit a crime. But I know of no jurisdiction where a trespass warning, where the visitor is specifically told to leave and not return, does not trump all of that. If you have been ejected from someone's property, and return to it at a later date, you are trespassing, period. It does not matter if you have disguised yourself such that you are not recognizable to anyone else as the same person; you still are that person, and that person is not allowed to be there.
- shabble 10y ago

WildUtah 10y ago

"This opinion is based on a fundamental misunderstanding of how the internet works." Your opinion is based on a fundamental misunderstanding of how the law works. Under the CFAA, to "intentionally accesses a computer without authorization" is a federal crime under most circumstances. If you don't have a written authorization from Facebook before you send your first HTTP request, you're already a criminal. Of course, the prosecutors interpret that to mean, at various times, exactly whatever they feel it should mean. You can't tell in advance what that will be. But the judges and the jurors will pretty much follow whatever they say because they don't understand what happened. In that case, it's natural for them to just go along with whatever the FBI's paid 'experts' tell them. That's how we keep law and order in a free country.

balabaster 10y ago
He didn't access a computer, he requested information from the computer, over a public channel, which was given. This is a semantic difference so it doesn't matter that the CFAA that they consider the crime "intentionally accessing a computer without authorization" - he didn't remote desktop to the machine and log in and access the file system and get information. He used the OAuth protocol which is afforded over public channels exactly as prescribed to say "This user has granted me access to this information, please give it to me" and Facebook has said "here you go"... This is akin to asking for the information, being issued a cease and desist to prevent you from asking for it again and then using the Freedom of Information Act to request information and subsequently being arrested for being in possession of that information on the grounds that you illegally obtained that information by breaking and entering and accessing files you weren't authorized to access... which you can see is clearly not true.